List data breaches

GET /v1/breaches returns every data breach our breach-data provider knows of, in one answer: which company or service was breached, when, how many records, and which kinds of data they hold. It answers “which breaches exist, and what is in them?”. To learn whether one email address is in them, use the breach search instead.

When to use it

Show a catalogue of breaches in your own tool, like orelys.io/pwned.
Look up what a breach holds — its kinds of data, size and dates — by its id or its name.
Follow new breaches: the most recently added come first.
See which group claimed an attack, in claimed_by.

Request

GET /v1/breaches. No parameters, no body, no key.

curl https://api.orelys.io/v1/breaches

const response = await fetch("https://api.orelys.io/v1/breaches", {
  signal: AbortSignal.timeout(120_000),
});

if (response.status === 429 || response.status === 503) {
  const wait = Number(response.headers.get("Retry-After") ?? "60");
  throw new Error(`Breach list not available, try again in ${wait} s.`);
}
if (!response.ok) {
  const { error } = await response.json();
  throw new Error(error.code);
}

const list = await response.json();
console.log(`${list.count} breaches, ${list.records} records`);
for (const breach of list.breaches.slice(0, 10)) {
  console.log(breach.name, breach.breach_date, breach.data_types.join(", "));
}

import requests

response = requests.get("https://api.orelys.io/v1/breaches", timeout=120)
response.raise_for_status()
data = response.json()

print(data["count"], "breaches,", data["records"], "records")
for breach in data["breaches"][:10]:
    print(breach["name"], breach["breach_date"], ", ".join(breach["data_types"]))

The list comes from a copy the API keeps and refreshes in the background, so it usually answers at once. Only when the API has no copy at all, just after a restart without a saved one, does a call wait for our breach-data provider: up to about 90 seconds, or 503 breach_catalogue_unavailable if that load fails. The timeout above leaves room for it.

What you get back

{
  "count": 878,
  "records": 12345678901,
  "updated_at": "2026-10-03T08:15:00.000Z",
  "breaches": [
    {
      "id": "kimberly-clark-2026",
      "name": "Kimberly-Clark",
      "logo_url": "https://api.orelys.io/v1/…",
      "breach_date": "2026-09-13",
      "added_date": "2026-09-30",
      "records": 651185,
      "data_types": ["email", "full_name", "phone", "location_street", "birth"],
      "reported_types": ["ssn"],
      "sensitive": false,
      "unverified": false,
      "claimed_by": "ShinyHunters"
    }
  ]
}

Field	What it is
`count`	Number of breaches.
`records`	Sum of the known `records` of every breach.
`updated_at`	When this copy of the list was fetched, ISO 8601 in UTC.
`breaches`	Every breach, the most recently added first, then by breach date (newest first), then by name.

Each breach has:

Field	What it is
`id`	Stable identifier: lowercase letters, digits, dots, hyphens and underscores, e.g. `kimberly-clark-2026` or `duolingo.com-2023`.
`name`	The breached company, site or service.
`logo_url`	URL of the breach logo, as an image.
`breach_date`	Estimated date of the breach, `YYYY-MM-DD`, or `null`.
`added_date`	Date it was added to the list, `YYYY-MM-DD`, or `null`.
`records`	Number of records (rows), or `null` when unknown.
`data_types`	The kinds of data it holds, the most frequent first. `[]` when unknown.
`reported_types`	Kinds of data, with the same keys, that the breach’s write-up reports — a notice letter, press reporting, a researcher — but that are not counted in `data_types`. Read from the write-up’s “What Information Was Compromised?” section; a kind it says was not exposed is never listed. `[]` when there are none. Show them apart from `data_types`, as reported rather than counted.
`sensitive`	Flagged as sensitive — for example health or very personal data.
`unverified`	Not confirmed as genuine.
`claimed_by`	The group that claimed the attack, such as `ShinyHunters`, when one did. `null` otherwise.

Cost and limits

The list is free: no key, no account, no credits, nothing taken from a quota. It works the same with any plan, or with none. Its only limit is the 120 calls a minute per address shared with every call to the API (rate limits). Past it, the API answers 429 ip_rate_limited: wait for Retry-After seconds — the minute is a sliding window.

Errors

Status	Code	When
`405`	`method_not_allowed`	The list was not asked with `GET`.
`429`	`ip_rate_limited`	Over 120 calls a minute from your address. Wait `Retry-After` seconds.
`503`	`breach_catalogue_unavailable`	The breach list cannot be loaded for a moment. Wait `Retry-After` seconds (60).

Errors use the usual envelope: { "error": { "code": "…", "message": "…" } }.

Tips

Fetch it once, keep it a few minutes. The whole list — close to 900 breaches — comes in one answer. Keep a copy on your side rather than fetching it on every page view. updated_at changes at most every 30 minutes: asking more often brings nothing new.
Call it from your backend. The API does not answer browser calls from other sites, so a web page should get the list through its own server.
Show names as text. Breach names come from third parties: never render them as HTML.
Keep unknown keys. data_types is not a closed list: show a key you do not know as it is. What each key means →
Checking an address? The breach search returns the breaches that hold it, with these same fields, plus a summary and the kinds of data the address was found under.

Reference

The response schema, and a playground to try it.

Get started

Essentials

Intelligence X

OSINT

Data breaches

Privacy